FORTIGATE VPN TUNNEL ISSUE (FortiOS v6.4.12 build2060 (GA)

[samaly999]

I Need to create VPN tunnel with below mention parameters from (Site A to Site B)

Site A is fully configured need to configured (Site B) on fortinet firewall.

                                                  SITE A                      SITE B

Termination Equipment (type, OS version, etc…)	Cisco
Ike Version	Ike Version 2
Encryption Algorithm	AES-256
Integrity (hash) algorithm	SHA-256
Peer Authentication Method
IKE Key exchange parameters (Diffie-Hellman group identifier)	DH-Group 14
IKE-established security association’s lifetime (Phase-1)	1800 (Sec)
IP address of IPSEC peer	192.168.7.3	192.168.247.122
Local IP Addess(s)		Source/Natted/Tunnel IP address will be  10.12.157.98 /32 (Route Base VPN)
DPD (Dead Peer Detection)	20s
Phase II
Encryption Algorithm	AES-256
Integrity (hash) algorithm	SHA-256
IKE Key exchange parameters (Diffie-Hellman group identifier)	DH-Group 14
IKE-established security association’s lifetime (Phase-2)	1800 (Sec)
Services Allowed
Perfect Forward Secrecy	PFS

[saneeshpv_FTNT · Accepted solution]

Phase1:

config vpn ipsec phase1-interface
edit "VPN Test"
set interface "port1"
set keylife 1800
set peertype any
set net-device disable
set proposal aes256-sha256
set dhgrp 14
set remote-gw 192.168.7.3
set psksecret ENC piXvQeygHtsE5kTWpQijutWZS+1X0VfMVFCDOXVYZCIXw+hGvkQ==
next
end

Phase2:

config vpn ipsec phase2-interface
edit "VPN Test"
set phase1name "VPN Test"
set proposal aes256-sha256
set dhgrp 14
set keylifeseconds 1800
set src-subnet x.x.x.x 255.255.255.0             (x.x.x.x is Local Subnet on FortiGate Side)
set dst-subnet y.y.y.y 255.255.255.0               (y.y.y.y is Local Subnet on Cisco Side)
next
end

After this you need to create Required policy and Route Configuration to route traffic via IPSec Tunnel.

Static Route will be to y.y.y.y/mask with interface 

config router static
edit 1
set dst y.y.y.y 255.255.255.0
set device "VPN Test"
next
end

Note: Configuration may slightly vary depending on your setup. 

[saneeshpv_FTNT]

x.x.x.x  will be FortiGate Side LAN 

y.y.y.y will be Cisco side LAN